Privacy Policy

Last updated: July 16, 2026

1. Who We Are

Daily Gita Meditation (“we,” “us,” “our”) is an open-source project licensed under AGPLv3, supported by voluntary gifts (dāna). We have no advertisers, no investors, and no business model that involves your data.

2. The Android App: No Personal Data Collected

The Daily Gita Meditation Android app works without an account and collects no personal information:

• Everything stays on your device.Your name (used only to greet you), practice history, sit durations, journal entries, and reflections are stored solely in the app's private storage on your phone. They are never transmitted to us or anyone else. Uninstalling the app deletes them.
• Content requests are anonymous. The app fetches verses, teachings, and meditation audio from our servers without any identifier tied to you. Server logs used for rate limiting and security are ephemeral and are not linked to individuals.
• No analytics SDKs, no tracking, no ads. The app contains no analytics or advertising SDKs of any kind, and stores no identifier on your device for measurement. We do count how many devices opened the app each day, so we can tell whether the app is useful to anyone. The counter stores a one-way hash of your IP address and browser string, keyed to that single date — it identifies a device for one day and cannot be linked to the day before or after, by us or by anyone reading our database. It is a headcount, not a profile, and it is never joined to anything you write or do in the app.
• Gifts (dāna) are processed entirely by Google Play's billing system; we never receive your payment details or purchase identity. Google's handling of payments is covered by Google's Privacy Policy.
• Reminders are local. The morning reminder is scheduled on your device; no push-notification service is involved.

3. We Share Nothing, With Anyone

We do not sell, share, rent, or disclose any data to any third party — not to advertisers, data brokers, analytics companies, or AI providers. All content is served from our own self-hosted servers. There are no third-party scripts, trackers, or cookies embedded in the app or the website.

4. Website Accounts (Optional)

The livegita.org website can be used without an account. If you choose to create one, the only data we hold is what you provide: your email address, a display name, date of birth (age verification), and a password hash (never your plaintext password), together with anything you choose to save — bookmarks, course progress, and reflections. This is stored on our own servers, used solely to provide the service back to you, and shared with no one.

Reflections may record your philosophical and spiritual thoughts. Under GDPR Article 9, this constitutes special-category personal data (religious/philosophical beliefs), which we process only with your explicit consent. Community posts you publish are visible to other users.

5. Technical Data

Like every internet service, our servers momentarily see your IP address in order to respond to requests and to rate-limit abuse. These records are ephemeral (rate-limit keys expire within 24 hours), are not linked to any person, and are never used for tracking or profiling. We use no analytics cookies. Your raw IP address is never written to our database: the daily-open counter described in section 2 stores only a date-keyed one-way hash, which is deliberately useless for following anyone over time.

6. Data Retention

• Android app data: lives only on your device; we never have it.
• Website reflections & community posts: retained for the lifetime of your account unless you delete them.
• Website account data: retained until you delete your account.
• Rate limiting data: expires automatically within 24 hours.
• Daily-open counts: kept as aggregate day totals. The date-keyed hashes are meaningless beyond their own day.
• Backups: retained for 30 days, then permanently deleted.

7. Your Rights

GDPR (EU/EEA)

• Access: Request a copy of all your data (Settings → Export Data).
• Erasure: Delete your account and all data (Settings → Delete Account).
• Portability: Export your data as JSON.
• Withdraw consent: Disable reflection cloud sync at any time in Settings.
• Object: Contact us to object to any processing based on legitimate interest.

CCPA/CPRA (California)

• We do not sell or share your personal information — for advertising or anything else.
• You may request deletion of your data at any time.
• Religious beliefs and health data are sensitive personal information under CPRA.

DPDP Act (India)

• You may withdraw consent and request erasure at any time.
• Grievance officer contact: see Section 10 below.

8. Children

Daily Gita Meditation requires users to be at least 16 years old (18 in India). We do not knowingly collect data from children below these age thresholds. If you believe a child has created an account, please contact us.

9. Security

We use encryption in transit (TLS), encrypted passwords (bcrypt), row-level authorization on all user data, and rate limiting to protect against abuse. The application runs in Docker containers with non-root processes and internal-only database networks on servers we operate ourselves.

10. Contact

For privacy inquiries, data access requests, or to exercise any of your rights:

• Email: privacy@livegita.org
• Grievance Officer (India): privacy@livegita.org

We respond to all requests within 30 days.

11. Changes

We may update this policy. Significant changes will be communicated via the app. Continued use after changes constitutes acceptance.